WordPress plugin Image Hover Effects Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2022-19556 · WordPress · Image Hover Effects Ultimate

Name of the Vulnerable Software and Affected Versions: Image Hover Effects Ultimate plugin for WordPress versions up to, and including, 9.7.3 Description: The issue is related to Stored Cross-Site Scripting via the Media Image URL value that can be added to an Image Hover due to insufficient inpu...

Image Hover Effects Ultimate < 9.8.0 - Authenticated Stored XSS

The plugin does not sanitise and escape the Media Image URL, Video Link, Title and Description field of an Image Hover, which could lead to Stored XSS when low privileged users are allowed to access the plugin's feature which can be set via the plugin settings...

BACnet Scanner

Discover BACnet devices by broadcasting Who-is message, then poll discovered devices for properties including model name, software version, firmware revision and description. Module Options msf use auxiliary/scanner/scada/bacnetl3 msf auxiliarybacnetl3 show actions ...actions... msf...

Adobe After Effects Buffer Overflow Vulnerability (CNVD-2022-58459)

Adobe After Effects is a suite of visual effects and motion graphics software from Adobe. A buffer overflow vulnerability exists in Adobe After Effects, which stems from the fact that the product uses the address at the end of the buffer for read and write operations. An attacker could exploit th...

Zoho Password Manager Pro XML-RPC Java Deserialization Exploit

This Metasploit module exploits a Java deserialization vulnerability in Zoho ManageEngine Pro before 12101 and PAM360 before 5510. Unauthenticated attackers can send a crafted XML-RPC request containing malicious serialized data to /xmlrpc to gain remote command execution as the SYSTEM user. This...

Reentrancy for function call before state update

Lines of code Vulnerability details Impact An external call "transfer" is made before updating state data through "setFuses" and "setFuses" does not depend on any data from "transfer". . Proof of Concept Reentrancy is not only an effect of Ether transfer but of any function call on another...

Reentrancy from _transferAndBurnFuses

Lines of code Vulnerability details Impact Reentrancy attack Proof of Concept The function transferAndBurnFuses is not performing Checks-Effects-Interactions pattern, and updates fuses after NFTs are transfered. An attacker can reenter because transfer is performing a doSafeTransferAcceptanceChec...

State Variable Shadowing

Lines of code Vulnerability details Impact Check: shadowing-state Severity: High Confidence: High It is possible to use the same variable twice in Solidity, but it can lead to unintended side effects.The TestAllowance.sol contract inherits from TesTBaseWorkflow.sol. In the TestAllowance.sol...

Missing reentrancy protections

Lines of code Vulnerability details Impact The files below contain both deposit and withdraw functions which seem re-entrable at the point of calls that transfer tokens. The functions do not fully follow a checks-effects-interactions pattern, thus they can be re-entered multiple times. Depending ...

CVE-2021-43755

Adobe After Effects versions 22.0 and earlier and 18.4.2 and earlier are affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit thi...

CVE-2021-43755

Adobe After Effects versions 22.0 and earlier and 18.4.2 and earlier are affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit thi...

Cross site scripting

Adobe After Effects versions 22.0 and earlier and 18.4.2 and earlier are affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit thi...

CVE-2021-43755

CVE-2021-43755 affects Adobe After Effects 22.0 and earlier and 18.4.2 and earlier, due to an Out-of-bounds Write from insecure handling of a malicious file. Exploitation requires user interaction (victim opens a crafted file) and could lead to arbitrary code execution in the user’s context. The ...

CVE-2021-43755 Adobe After Effects Memory Corruption could lead to Arbitrary Code Execution

Adobe After Effects versions 22.0 and earlier and 18.4.2 and earlier are affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit thi...

Design/Logic Flaw

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address including side effects could be evaluated twice. This may result in incorrect outcomes for contracts. This issue...

GHSA-4V9Q-CGPW-CF38 Multiple evaluation of contract address in call in vyper

Impact when a calling an external contract with no return value, the contract address could be evaluated twice. this is usually only an efficiency problem, but if evaluation of the contract address has side effects, it could result in double evaluation of the side effects. in the following exampl...

Multiple evaluation of contract address in call in vyper

Impact when a calling an external contract with no return value, the contract address could be evaluated twice. this is usually only an efficiency problem, but if evaluation of the contract address has side effects, it could result in double evaluation of the side effects. in the following exampl...

PT-2022-19503 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.3.4 Description: The issue arises when calling an external contract with no return value, potentially resulting in the contract address being evaluated twice, including any side effects. This could lead to incorrect...

WordPress Hover Effects plugin local file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Hover Effects plugin 2.1 and earlier versions have a local file inclusion vulnerability, which stem...